Security and data handling

SocialToAI needs no account of yours, stores API keys only as hashes, keeps the answer to a call for 24 hours so that you can read it again, and keeps commenters anonymous.

Your platform accounts

• No account of yours is needed: no sign-in to a platform, no cookie, nothing to install. Nothing is read in your account's name.

API keys

• We store only a key's SHA-256 hash and its last four characters. The whole key is shown once, when it is created, and cannot be shown again.
• A key is not written to logs, to page addresses or to browser storage. A request that carries a key in its address is refused, and is told to revoke that key.
• Each key can have its own permissions, expiry date and daily limit; you can revoke it at any time in the console.

Signing in from an AI app

• ChatGPT, Claude and other clients that can sign in use OAuth with PKCE, and never see a key. You press Allow on our page, and can revoke the connection in the console.
• Tokens are stored only as hashes. An access token lasts one hour; a refresh token changes every time it is used.

Results and request details

• The answer to a call is stored encrypted (AES-256-GCM) for 24 hours, so that you can read it again for free, and then deleted. Only the key that made the call can read it over the API; the account's owner can read it in the console.
• A ready-made tool's run also keeps a summary for 30 days: numbers and links only.
• The parameters of a call are kept for 90 days and then cleared.

Commenters

• Commenters are always anonymous: a label for that one request, with no name, id or avatar, even for verified accounts.

Logs

• Run logs do not keep the full responses we read. Access logs keep the path before the question mark, and credentials in headers are masked.

Payment

• Checkout is hosted by Stripe, so a card number never reaches us. Credits are added only when Stripe's signed notice arrives.

Deleting your account

• You can delete your account yourself in the console's settings; its keys stop working at once. The privacy policy says what is kept and for how long.

Report a security problem

• Write to support@socialtoai.com.

Last updated: 2026-11-06